ci: validate the chart against the pinned decdn release and drop version-pinned prose

[thiras]

Closes #145. Once this lands, a decdn bump PR whose CI is green and whose body has no "Needs work" list needs no hand edits.

Chart check in CI

• New scripts/fetch-decdn-cli.sh <dir> downloads the decdn CLI of the release appVersion pins and verifies it as roles/decdn_node/tasks/install.yml does. It prints only the binary's path on stdout. Checks:
  • gpg must exit 0;
  • the signature (VALIDSIG) must come from a key in the vendored decdn-release-KEYS.asc;
  • no EXPKEYSIG, REVKEYSIG or EXPSIG (gpg --verify exits 0 for those);
  • exactly one manifest entry for the archive, checked with sha256sum --check --strict;
  • the binary must report decdn <version>, checked before it is installed.
• CI's helm job runs make lint-helm with DECDN_CLI set from it. The assignment and the export are on separate lines, so a failed fetch fails the step instead of becoming a SKIPPED.
• The helm path filter adds the script and the KEYS file, and make test-scripts checks both are listed.
• Removed the "CI has no binary" text and the bump PR's "Validate the chart" item.

Prose that named the version

• bump_decdn.py rewrite also moves:
  • the commented examples keyed by a variable name: decdn_node_version and decdn_node_source_ref in host_vars, sponsord_onramp_decdn_release in group_vars, in both inventory trees and in cloud-init/user-data-publisher.yaml;
  • AGENTS.md's pinned decdn version, which may wrap across lines.
• Prose that only restated a pinned decdn or sponsord version now names the pin.
• AGENTS.md's "Pinned upstream releases" is the one doc that names the numbers, and make test-scripts checks them against the role defaults.
• open-decdn-bump.sh drops the old-version grep and its "Before merging" checklist. The "Needs work" list and the exit codes are unchanged.
• History notes ("since v0.0.2") and the schema floor's "taken at" comment are left alone.

Testing

• make test-scripts passes. It now builds a fixture release signed with throwaway gpg keys and served over file://:
  • a good release, which installs;
  • refusals for:
    • a key outside KEYS;
    • a second signature by an unknown key (gpg exits 2);
    • an expired key;
    • a revoked key;
    • no manifest entry;
    • two entries;
    • a swapped valid archive;
    • a binary reporting the wrong version;
    • a non-X.Y.Z version.
  • Each refusal must show its own message and write no binary.
• Removing each of five checks from the script makes a test fail: the gpg exit code, the sha256 check, the expired/revoked check, the version compare and the X.Y.Z check.
• bump_decdn unit tests pass, with the new files covered and an AGENTS.md wrap test.
• A real rewrite to 9.8.7 in a scratch copy moves every pin, example and AGENTS.md. The pin check passes, and examples/collection-fleet stays identical to ansible/inventory.
• fetch-decdn-cli.sh against the real v0.0.4 release, then make lint-helm with that binary: decdn config validate passes on all three ci/*.yaml renders.
• make lint passes.

Not done: making render-test.sh fail when it runs in CI without DECDN_CLI. release-chart.yml also runs make lint-helm without a binary, so that guard would break chart releases.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The verification chain, CI integration, bump rewrites, synchronized examples, and negative tests are complete and consistent.

0 open findings

What changed in this PR

Adds verified real-binary chart validation to CI and automates version-reference updates during deCDN bumps.

Changes:

• Adds and tests secure fetching of the pinned decdn CLI.
• Extends bump automation to update keyed examples and AGENTS.md.
• Replaces duplicated version numbers in documentation with pin references.

File	Description
.github/​workflows/​ci.yml	Runs chart validation with the verified CLI.
scripts/​fetch-decdn-cli.sh	Fetches and verifies the pinned CLI.
tests/​scripts-test.sh	Tests fetch security and CI path filters.
scripts/​bump_decdn.py	Rewrites keyed version examples and prose.
scripts/​tests/​test_bump_decdn.py	Covers the expanded rewrite behavior.
scripts/​open-decdn-bump.sh	Removes obsolete manual bump steps.
AGENTS.md	Documents automated validation and pin handling.
CONTRIBUTING.md	Updates lint-helm guidance.
charts/​decdn-node/​tests/​render-test.sh	Documents CI-provided CLI validation.
charts/​decdn-node/​README.md	Documents verified CLI fetching.
ansible/​roles/​decdn_node/​README.md	Updates release-bump workflow documentation.
ansible/​README.md	Replaces duplicated versions with pin names.
cloud-init/​README.md	References role pins instead of versions.
compose/​README.md	References Compose image pin variables.
compose/​.env.example	Generalizes the sponsord release comment.
ansible/​roles/​sponsord/​README.md	Generalizes release documentation and checklist.
ansible/​roles/​sponsord/​tasks/​main.yml	Uses a non-current example version.
ansible/​roles/​sponsord_onramp/​README.md	Generalizes release documentation.
ansible/​roles/​sponsord_onramp/​tasks/​main.yml	Uses a non-current example version.
ansible/​inventory/​group_vars/​sponsord_onramp_hosts.yml	References the node version pin.
examples/​collection-fleet/​inventory/​group_vars/​sponsord_onramp_hosts.yml	Mirrors the inventory documentation update.
ansible/​galaxy/​publisher/​README.md	References sponsord pin variables.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.